Pin dependencies

.github/workflows/build.yml

@@ -25,7 +25,7 @@ jobs:
     name: Build
     runs-on: ${{ inputs.runner }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
         with:
           persist-credentials: false
       - name: Configure System
@@ -49,7 +49,7 @@ jobs:
         id: path-generator
         run: echo "PWD=$(pwd)" >> "$GITHUB_OUTPUT"
       - name: Archive Build Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: elastic-ebpf-${{ inputs.architecture }}
           path: ${{ steps.path-generator.outputs.PWD }}/artifacts-${{ inputs.architecture }}/elastic-ebpf-${{ steps.version-generator.outputs.ELASTIC_EBPF_VERSION }}-SNAPSHOT.tar.gz

.github/workflows/issues.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/add-to-project@v0.3.0
+      - uses: actions/add-to-project@a9f041ddd462ed185893ea1024cec954f50dbe42 # v0.3.0
         with:
           project-url: https://github.com/orgs/elastic/projects/765
           github-token: ${{ secrets.ELASTIC_PAT }}

.github/workflows/multikernel-tester.yml

@@ -38,7 +38,7 @@ jobs:
     runs-on: ${{ inputs.runner }}
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
       with:
         persist-credentials: false
     - name: Install packages needed for testing
@@ -57,14 +57,14 @@ jobs:
     - name: Get Env
       run: echo "ELASTIC_EBPF_VERSION=$(cat VERSION)" >> $GITHUB_ENV && echo "PWD=$(pwd)" >> $GITHUB_ENV
     - name: Download Build Artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: elastic-ebpf-${{ inputs.architecture }}
         path: ${{ env.PWD }}/artifacts
     - name: Untar
       run: cd artifacts && tar -zxf elastic-ebpf-${ELASTIC_EBPF_VERSION}-SNAPSHOT.tar.gz
     - name: Install Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3
       with:
         go-version: '1.22'
     - name: Run tests
@@ -76,13 +76,13 @@ jobs:
         mkdir -p logs && mv testing/results logs/${{ matrix.kernel_flavor }}-${{ inputs.architecture }}
     - name: Archive test summary
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: result-summary-${{ matrix.kernel_flavor }}-${{ inputs.architecture }}.txt
         path: results-${{ matrix.kernel_flavor }}-${{ inputs.architecture }}.txt
     - name: Archive individual test results
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: logs-${{ matrix.kernel_flavor }}-${{ inputs.architecture }}.txt
         path: logs

contrib/libbpf/.github/workflows/build.yml

@@ -42,7 +42,7 @@ jobs:
           - name: gcc-12
             target: RUN_GCC12
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
         name: Checkout
       - uses: ./.github/actions/setup
         name: Setup
@@ -63,14 +63,14 @@ jobs:
           - arch: s390x
           - arch: x86
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
         name: Checkout
       - uses: ./.github/actions/setup
         name: Pre-Setup
       - run: source /tmp/ci_setup && sudo -E $CI_ROOT/managers/ubuntu.sh
         if: matrix.arch == 'x86'
         name: Setup
-      - uses: uraimo/run-on-arch-action@v2.0.5
+      - uses: uraimo/run-on-arch-action@cd5f294c3b7be88bc5b708fe25e1af36818f9ead # v2.0.5
         name: Build in docker
         if: matrix.arch != 'x86'
         with:

contrib/libbpf/.github/workflows/cifuzz.yml

@@ -33,7 +33,7 @@ jobs:
           dry-run: false
           sanitizer: ${{ matrix.sanitizer }}
       - name: Upload Crash
-        uses: actions/upload-artifact@v1
+        uses: actions/upload-artifact@3446296876d12d4e3a0f3145a3c87e67bf0a16b5 # v1
         if: failure() && steps.build.outcome == 'success'
         with:
           name: ${{ matrix.sanitizer }}-artifacts

contrib/libbpf/.github/workflows/codeql.yml

@@ -32,10 +32,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2
         with:
           languages: ${{ matrix.language }}
           queries: +security-extended,security-and-quality
@@ -49,4 +49,4 @@ jobs:
           make -C ./src
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2

contrib/libbpf/.github/workflows/coverity.yml

@@ -11,7 +11,7 @@ jobs:
     if: github.repository == 'libbpf/libbpf'
     name: Coverity
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
       - uses: ./.github/actions/setup
       - name: Run coverity
         run: |

contrib/libbpf/.github/workflows/lint.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
       - name: Run ShellCheck
         uses: ludeeus/action-shellcheck@master
         env:

contrib/libbpf/.github/workflows/ondemand.yml

@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     name: vmtest with customized pahole/Kernel
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
       - uses: ./.github/actions/setup
       - uses: ./.github/actions/vmtest
         with:

contrib/libbpf/.github/workflows/pahole.yml

@@ -12,7 +12,7 @@ jobs:
     env:
       STAGING: tmp.master
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
       - uses: ./.github/actions/setup
       - uses: ./.github/actions/vmtest
         with:

contrib/libbpf/.github/workflows/test.yml

@@ -31,7 +31,7 @@ jobs:
             runs_on: s390x
             arch: 's390x'
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
         name: Checkout
       - uses: ./.github/actions/setup
         name: Setup

docker/Dockerfile.builder

@@ -8,7 +8,7 @@ ARG SCRATCH=/misc/scratch
 # a static bpftool on a newer ubuntu and copy it to centos7
 # builder image to generate skeleton headers.
 
-FROM docker.io/ubuntu:jammy as bpftool-builder
+FROM docker.io/ubuntu:jammy@sha256:b8b6ee6aa931ecd9d0d952abc34dc0e5f7c6a30c6bb71b079fe399fde0329c02 as bpftool-builder
 ARG SCRATCH
 ENV DEBIAN_FRONTEND=noninteractive
 
@@ -30,7 +30,7 @@ RUN CFLAGS=-static make -C $SCRATCH/kernel/tools/bpf/bpftool
 
 
 # Stage 2: Centos 7 ebpf-builder
-FROM docker.io/centos:7 as ebpf-builder
+FROM docker.io/centos:7@sha256:be65f488b7764ad3638f236b7b515b3678369a5124c47b8d32916d6487418ea4 as ebpf-builder
 ARG SCRATCH
 RUN mkdir -p $SCRATCH
 

docker/Dockerfile.imagepack

@@ -1,4 +1,4 @@
-FROM docker.io/ubuntu:latest
+FROM docker.io/ubuntu:latest@sha256:da6fc2be547864451aa253836dd926da33623312df4a9a243e35dc877c378a78
 ARG IMGPACK_FILTER=
 COPY / /kernel-img-repository/${IMGPACK_FILTER}
 

testing/kernel_builder/Dockerfile

@@ -1,4 +1,4 @@
-from debian:bullseye
+from debian:bullseye@sha256:6f519a81440354a85eb592c5f32109ab80605f6b892455983a6f618bf87fabe9
 
 RUN dpkg --add-architecture arm64
 RUN apt-get -y update